CVE-2026-54289

{
  "id": "CVE-2026-54289",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-22T18:16:47.480",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25."
    },
    {
      "lang": "es",
      "value": "Hono es un framework de aplicación web que proporciona soporte para cualquier entorno de ejecución de JavaScript. Antes de la versión 4.12.25, en AWS Lambda@Edge, CloudFront entrega una cabecera de solicitud que aparece más de una vez como varias entradas separadas. El adaptador escribe cada valor con Headers.set en lugar de Headers.append, por lo que cada valor sobrescribe el anterior y solo el último llega a la aplicación. Las cabeceras de solicitud repetidas como X-Forwarded-For, Forwarded y Via se truncan silenciosamente a un único valor. El middleware de solicitud ve solo el último valor de una cabecera repetida en lugar de la cadena completa. Para las aplicaciones que basan el control de acceso en la cadena X-Forwarded-For, esto puede debilitar o alterar esa decisión; para la auditoría, se pierde el historial de saltos. Esta vulnerabilidad se corrige en la versión 4.12.25."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "honojs",
          "product": "hono",
          "versions": [
            {
              "version": "< 4.12.25",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-22T18:19:24.735156Z",
          "id": "CVE-2026-54289",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-348"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/honojs/hono/security/advisories/GHSA-wgpf-jwqj-8h8p",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/honojs/hono/security/advisories/GHSA-wgpf-jwqj-8h8p",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}